What is the CVSS score of EUVD-2025-20523?

EUVD-2025-20523 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Connect Secure are affected by EUVD-2025-20523?

Organizations using Ivanti Connect Secure should be aware of notable risk from CVE-2025-0293 rated CVSS 6.6. Exploitation could compromise the security of affected deployments.

How to fix or mitigate EUVD-2025-20523?

Within 30 days: Identify affected systems running Ivanti Connect Secure and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Connect Secure EUVD-2025-20523

| CVE-2025-0293 MEDIUM

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2025-07-08 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Code Injection Ivanti Connect Secure Policy Secure

6.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20523

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 16:15 nvd

MEDIUM 6.6

DescriptionNVD

CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk.

AnalysisAI

A security vulnerability in Ivanti Connect Secure (CVSS 6.6) that allows a remote authenticated attacker with admin rights. Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type not specified by vendor. Affects Ivanti Connect Secure.

RemediationAI

Monitor vendor channels for patch availability.

More from same product – last 7 days

CVE-2026-8992 HIGH This Week

8.8 May 22

Remote code execution in Ivanti Secure Access Client versions prior to 22.8R6 allows unauthenticated attackers to run ar

EUVD-2025-20523 vulnerability details – vuln.today

Back